Hide draft and private occurrences from anonymous series reads

[tompscanlan]

The problem

GET /api/events/series/:seriesSlug/events is a public route with no status or
visibility filter. Anonymous callers received draft and private occurrences of a
series along with the published ones. This is live today.

VisibilityGuard is applied to the route but never checks it. The guard reads a
:slug route param, and the only param on this route is :seriesSlug, so the
guard finds no event to look up and allows the request through.

The response also carried every loaded column, because neither EventEntity nor
GroupEntity has any @Exclude decorators. That included sourceData, which
holds the original poster's DID, handle, CID and rkey, and the internal
matrixRoomId.

The fix

findEventsBySeriesSlug takes a new optional publicOnly flag. When set, it adds
the same predicate the guard already applies to GET /events/:slug: published or
cancelled status, and public or unlisted visibility. The predicate runs in SQL
rather than after the fetch, so paging stays correct.

The controller sets the flag when the request has no user. Signed-in callers get
the same results they get today.

For anonymous callers the controller also clears sourceData and matrixRoomId.
sourceId is left in place because the web app renders it as the public AT
Protocol attribution link for events imported from Bluesky.

Why the flag is opt-in

About twelve internal callers share this method, including series materialization,
the existence check, and template lookup. Those need to see every occurrence.
If drafts were hidden from them they would treat existing occurrences as missing
and create duplicates. Only the public controller path passes the flag.

VisibilityGuard itself is unchanged. Teaching it about series would mean adding
a series lookup and a new branch to a guard that many routes depend on. The query
predicate gives the same result with a smaller blast radius.

Status values

The filter allows published and cancelled, not published alone. That matches the
guard at visibility.guard.ts and the other public queries in
event-query.service.ts. Without cancelled, a cancelled occurrence would quietly
disappear from a public series list instead of showing as cancelled.

Tests

Seven new tests, at both layers.

Four on the controller cover which callers get the restricted query and that the
two fields are cleared for anonymous callers only.

Three on the query service assert the predicates themselves, including that draft,
pending and private are all excluded, and that leaving publicOnly unset keeps
the query unrestricted so materialization still sees every occurrence.

Both layers are needed. The controller tests mock the query method, so on their
own they only prove the controller asks for a restricted query, not that the
query applies the restriction. Deleting the two predicates left all four
controller tests passing with the leak restored. The query service tests fail in
that case.

Not in this change

Anonymous access is what this fixes. Any authenticated user can still read every
occurrence and every field on this endpoint, which is existing behavior and is
tracked separately.

The endpoint also has no date filter, so a caller with no parameters gets the ten
oldest occurrences rather than upcoming ones. That is a real bug but it is not a
leak, and it is tracked separately.